France has formally accused Iran's Revolutionary Guard of a cyberattack that overheated refrigeration units at roughly 700 supermarkets in a single night. On Monday, Paris prosecutors opened a judicial investigation into suspected organized cybercrime committed on behalf of a foreign state, and they will ask for international arrest warrants against the operation's leadership.

Foreign Minister Jean-Noël Barrot said France was summoning the Iranian ambassador "to strongly protest against this extremely serious act." He called it the first large-scale cyber assault driven by sabotage ever staged on French soil, and said it "will not go unanswered." A promise of consequences, however, came without a specified mechanism — France says only that it will push for European-level sanctions against the perpetrators.

What do investigators actually have?

Prosecutor Laure Beccuau said the inquiry, formally opened Monday, names the group's leader and his two deputies, plus anyone else identified later. The evidentiary trail, as disclosed so far, rests on two technical signals: the attackers worked in Farsi, and they operated from IP addresses linked to equipment in Iran, according to The Associated Press.

The national digital security watchdog ANSSI (Agence nationale de la sécurité des systèmes d'information, France's cybersecurity agency) attributed the operation to Shahid Kaveh, a hacking branch tied to the Revolutionary Guard. Attribution of state-linked cyber operations is notoriously difficult; French authorities have published the conclusion but not the underlying technical evidence. Investigators named individuals, but prosecutors have not said whether any of them are within reach of European law enforcement.

How much damage did the attack cause?

The numbers are concrete. In the early hours of Oct. 12, hackers took remote command of cooling equipment across supermarkets and independent stores:

• Cooling units heated to 50 degrees Celsius (122 degrees Fahrenheit) and stayed there for roughly six hours.
• Stores discarded fresh and frozen stock en masse.
• Intermarché reported losses of "tens of millions of euros" in a single day, according to the AP.
• Affected retailers included Intermarché, E. Leclerc, Carrefour, Monoprix and Coopérative U.

How did the attackers get in?

The operation exploited the plumbing of ordinary retail infrastructure. According to CNBC, the attackers targeted controllers for refrigeration units supplied by Danfoss and Dixell, reaching them through the equipment's online interfaces. Once inside, they triggered defrost cycles with no time limit and switched off the sensors' safety warnings — a combination that turned a maintenance function into a weapon.

At Intermarché, Coopérative U and Leclerc stores, the attack on the night of Oct. 11 to 12 pushed Danfoss-made cooling systems into a nonstop defrost cycle. The warning signs predated the attack: in August, Team82, the research arm of cybersecurity firm Claroty, published a report on a hidden authentication mechanism in Danfoss systems that could be exploited to tamper with refrigeration operations. Neither the manufacturers nor the retailers have publicly explained why that disclosure did not translate into patched systems before October.

The exposure may not be confined to France. Supermarkets in other European countries reported fridge and freezer problems in November, according to CNBC, though no other government has issued a comparable attribution.

What does this change for retailers?

Barrot said on Tuesday, per CNBC, that France is "not ruling anything out," with possible responses including banning anyone deemed culpable from Europe and freezing their assets. Those measures presuppose that the named individuals hold identifiable European assets — a point officials have not addressed.

For retailers, the practical lesson is narrower: internet-connected building equipment is now a recognized target of state-linked sabotage. Refrigeration controllers sat outside most corporate security budgets; the October attack suggests that gap is what adversaries will keep testing.